Senior Security Engineer (On-Prem / Cloud) – Conditional Access & Privileged Identity Management (PIM)

Job Summary
We are seeking a Senior Security Engineer with strong expertise in Microsoft Entra ID (Azure AD), Conditional Access Policies, Privileged Identity Management (PIM), RBAC, and hybrid identity security. The ideal candidate will lead the design, implementation, and governance of security controls across on-premises and cloud environments, with a specialized focus on Conditional Access policies, PIM-enabled groups, and Fabric role-based access management. Microsoft Fabric uses Microsoft Entra Conditional Access as part of its identity-based security model, and PIM provides governance over privileged roles and assignments.
Responsibilities
Design and implement enterprise-wide Conditional Access (CA) Policies in Microsoft Entra ID.
Configure and manage Privileged Identity Management (PIM) for users, groups, Azure resources, and privileged roles.
Integrate Conditional Access Authentication Contexts with PIM role activations to enforce security controls such as MFA, compliant devices, location-based restrictions, and risk-based access.
Implement and maintain Role-Based Access Control (RBAC) and least-privilege access models.
Configure PIM-enabled Groups and link them to business applications, security groups, and Microsoft Fabric roles.
Define governance processes for privileged access reviews, access certifications, and entitlement management.
Secure hybrid identity environments including Active Directory, Entra ID, Azure, and cloud workloads.
Design access strategies for Microsoft Fabric, Power BI, Azure SQL, Storage, and associated cloud services protected by Conditional Access.
Collaborate with security, infrastructure, cloud, and compliance teams to implement Zero Trust security architecture.
Monitor privileged activities, investigate security incidents, and support audits.
Required Skills
8+ years of cybersecurity, IAM, or cloud security experience.
Strong expertise in:
Microsoft Entra ID (Azure AD)
Conditional Access Policies
Privileged Identity Management (PIM)
Identity Governance
RBAC and Access Control
Active Directory & Hybrid Identity
Azure Security
MFA, SSO, Federation
Microsoft Fabric Security
Experience configuring:
Authentication Contexts
PIM for Groups
Just-In-Time (JIT) Access
Access Reviews
Entitlement Management
Understanding of Zero Trust security architecture.
Experience with PowerShell, Graph API, or automation scripting.
Strong knowledge of security frameworks and compliance requirements.
Preferred Qualifications
Microsoft Certified:
SC-300: Identity and Access Administrator
SC-100: Cybersecurity Architect
AZ-500: Azure Security Engineer
Experience with Microsoft Fabric security administration.
Experience securing large enterprise hybrid environments.

Work arrangement
Yes